Clive Robinson • July 29, 2017 12:19 AM

Reallife catches up with James Bond gadgets

In the film OHMSS James Bond breaks into a Swiz Solicitors office at lunchtime and a largish gadget is brought by crane to the window.

Bond is then seen putting a dial sensor head onto the safe combination lock, which then fairly quickly finds the combination and the safe is opened.

Well at DefCon such a gadget was demonstrated on a similar commercial safe,

http://www.bbc.com/news/technology-40760648

Clive Robinson • July 29, 2017 12:40 AM

Why drugs wars fail

It is now many yeats since an economist made an observation about dealing with the Wester Drug Problem.

Many places opted the “war path” whilst a few braver ones chose a different path.

Well fourteen years after Portugal effectively De-criminalized drugs it has had a very significant drop in the rate of drug deaths and is now one of the lowest per head of population in Europe.

https://mic.com/articles/120403/14-years-after-decriminalizing-drugs-one-chart-shows-why-portugal-s-experiment-has-worked

The key point is that they moved who dealt with drugs from the justice system to the health system.

I guess this success story is not what the “War on drugs” devotes want to hear. But hopefully it will encorage other nations to try the same and thus we get better insight to the issue.

Clive Robinson • July 29, 2017 8:08 AM

@ Thoth,

A new directive from the SG MINDEF requires all SG military personnel … via downloading the SGSecure app

Two things to say about it,

Firstly just how stupid is the SG, they have just made all their armed forces “targets”. If I was a SigInt agency in another nation I would get a copy of thr app and rip it appart to find weaknesses that could be used to identify SG MF personnel and their locations and habits (as has been done to other nations MF).

Secondly if I was a SG MF person my phone would rather quickly not be a Smart Phone… One of those Nokia 610 look alike “granny phones” with the big keys would be nice 😉

Clive Robinson • July 29, 2017 2:16 PM

@ Iask,

Does an extra chunk of plastic glued onto the existing, longtime card reader of an ATM ever have a legitimate purpose?

Very rarely. Some ATMs have had modifications to make the insertion of shims harder, others clear blocks to prevent earlier types of skimer. Have a look at Brian Krebs site, he has a page dedicated to ATM skimers and pictures showing not just skimmers but ATM modifications.

Clive Robinson • July 30, 2017 3:46 AM

@ Rachel,

Now Honolulu becomes the first major U.S. city to pass legislation aimed at reducing injuries and deaths from “distracted walking.”

I must admit I’m all for it but it will not go far enough.

As I’ve mentioned before I use elbow crutches. The consequence of this is unless I behave recklessly I move slower than those walking behind me. Thus just like a post or rock in a flowing stream I have an eddy in front of me. People comming towards me discover that when they get to me I’m not going to get out of the way because it’s dangerous for me to do so. So they push back into the oncomming stream and create considerable turbulance when they do.

HOWEVER you get the “dip5h1ts” playing with their phones, iPods, games consoles and even watching movies… I see them and I stop, they walk into me, and then some have the gaul to accuse me of being in the way.

Although I have not done it yet the temptation to kick them hard somewhere sensitive then shish kebab them on one of my crutches is getting to the point of irresistability.

Perhps a law that would permit me to just stomp on them till they squealed –not squelched– would stop me from doing one of them serious injury from the shish kebabing they so rightly deserve…

Clive Robinson • July 30, 2017 12:50 PM

@ ab praeceptis,

I’m *strongly opposed* to any laws against using smartphones (or even blindfolding) while walking. Reason: Such laws would hamper the process of natural selection.

I don’t care if they make it illegal or not, jay walking laws have not stopped jaywalking.

What I want is like a “stand your ground law” for anyone the varmints walk into, and then have the gaul to blaim the person who was not beying a jacka55.

Obviously I don’t want a “throw them under a bus” law, because that has other side effects. Just a law that alows me to take a bit of indignant action to make them realise that,

A, they were being totaly gormless.
B, that gormless behaviour can hurt.

Though I do like the idea of open manhole covers, and perhaps a few low hanging branches or signs.

If they don’t get feedback that certain actions are not to be taken, then there is no incentive for the gormers not to do them. There is that old saying about “Children and fools should not play with sharp edged tools”. Whilst I would not wish to lop off their texting finger perhaps a little twisting to give a sharp reminder, much like the old story about children and hot things. After all it is the T sensor that indicate pain when we over reach and cause the autonomic snatch back/drop action is we touch something hot. Obviously it follows that pain is part of the natural learning process for dangerous activities. So why should I not administer a little pain to a gormer that walking into a six foot six guy on crutches is not a risk free activity.

Oh and the reason for pain not removal from the genetic pool is so they can show their injuries to their friends who are just as likely to be other gormers and hopefully they will learn with out me having to go to the effort of teaching them the hard way.

Clive Robinson • July 30, 2017 11:51 PM

@ tyr, Wael,

How hard would it be to make a cell phone that won’t work while in motion? If it detects you walking it stops working. IF the GPS senses motion it stops working.

It’s conceptually simple but practically hard, very hard, and there is no way to make it reliable in action in human terms.

To see why invert the premise and make the operating function a counter. Such a product exists and is called a pedometer. Untill recently there was no point in cheating a pedometer because there was no value in doing so. However insurance companies have changed the game and there is now value in cheating a pedometer by way of reduced –normally way over priced– health care policies.

With the advent of an incentive to cheat a pedometer lots of inventive minds have got to work. In effect the insurance companies have stupidly invented an arms race they can not win. People will think up simple ways to cheat those pedometers, the insurance companies will think up counter measures to catch the cheaters and so that loop goes around each time some cheaters will find a method to beat the counter measures. We’ve seen this before with ECM / ECCM / ECCCM and commercialy with the subscription service Sky Satellite Broadcasting.

Mean while the insurance companies get locked into a second ECM war with other insurance companies playing “follow the leader”. Worse by legislation (Obama Care) every citizan has to have health care insurance… You can see where that is going to go, as was said in the film, the only sensible move is not to play.

Flipping the premise back up you will see that if their is “wriggle room” then people will cheat the system because they see value in doing so. But worse still if only one company put in an anti-walk-n-talk option it would quickly go out of business because such a feature has “negative value” for a purchaser.

Thus the only way to attempt to get it would be by legislation, which will fail as reliable technology does not yet exist. Which as we know with “Smart Guns legislation” is likely to have a perverse effect on the manufacturers. That is they will find ways to ensure the idea never becomes reliable, so never gets put on the market to become a legislative market killer…

The problem is there is two much wriggle room, and two or more types of movment detection required thus there will be not just edge cases but corner cases, and each attempt to improve detection will double up at minimum the number of courner cases and more for the edge cases.

The two current movment detectors are tuning fork gyroscopes and satellite position fixing (GPS). Neither is reliable or even suitable for the application. GPS is slow and has an inacuracy margin short term greater than you would get with walking or dancing. You could average out by integration but to tell the difference between ordinary hand body movment whilst sitting or standing will require a long integration time. Likewise the gyroscopes have a sensitivity issue in that they are “band pass” detectors and will not detect absolute position, as movment above a certain speed or below a certain speed will either not register or will register inaccurately.

I could go on at further length but I think you both know enough to fill in the rest for yourself.

Clive Robinson • July 31, 2017 8:58 AM

@ Moderator,

I made a reply to Figureitout around 2AM blog time. I’v just noticed it’s not hear. Did it get caught or have I posted to the wrong place?

Clive Robinson • July 31, 2017 9:40 AM

@ ab praeceptis, Dirk Praet,

It seems to me that you overlook four points

There is a “point zero” you’ve left out,

0, Humans are born helpless.

Mankind is unusual for the type of creature we are, our offspring are born capable of very little, and spend the rest of their lives –if they are sensible– learning.

I’ve been known to take an absolutist view on security in the past and in some respects I still do.

However even though I myself take security precautions others would consider totally over the top if not paranoid. I still know I’m lazy in many OpSec respects.

The problem is it’s difficult even for someone who is close to clinical paranoia to live at high OpSec levels without crashing and burning or worse going over the edge into full scale psychosis[1].

Thus I accept that it’s an exceptional person who can live like that for even short periods of time even with extensive training and aclimatisation experience.

Whilst I would not want people to give up in despair, I recognise the experience curve whilst starting gradually can appear vertical at times. So not insurmountable but requires training and equipment etc.

Further I also know from long experiance that the level of OpSec / security required varies depending on situational requirments. When things do go wrong is when there is a mismatch between situational requirments and OpSec / security employed. Interestingly many do not realise that being over secure and employing to much OpSec actually is more harmfull in the short term than to little that tends to be harmfull in the long term.

Thus I would rather people start gently and take their time developing their skills than try and jump in at the deep end flounder and drown.

Rome was not built in a day nor did it die suddenly, it’s partial demise was due to the inability of those in charge to change to changing situational requirments. However some did learn which is why we have the likes of the Holy Roman Empire.

[1] I use the dictionary definition of,

psychosis : A severe mental disorder in which thought and emotions are so impaired that contact is lost with external reality.

Rather rhan the ICD10 F29 definition, http://www.icd10data.com/ICD10CM/Codes/F01-F99/F20-F29/F29-/F29

Clive Robinson • July 31, 2017 11:04 AM

@ Moderator,

Hmm sounds like a ‘fat finger’ problem at my end.

@ Figureitout,

I will put my “memory cap” on and see if I can recreate my comment a little later (it’s rush hour in London currently, or “strap hanging” time depending on your prefrence).

Clive Robinson • August 1, 2017 8:24 AM

@ ab praeceptis,

I mentioned Amdahls law because, while originally looking at performance, it’s quite simple and can make statements about security as well.

It can but it’s inwards focused not out wards focussed which is why you have to be mindful of an idea from a century befor by the English economist William Stanley Jevons.

A century and a half ago he observed that technological improvements that increased the efficiency of fuel usage gave rise to not just an increase of fuel consumption –not drop– but a significantly increased consumption.

His argument was that rather than the simplistic view that energy consumption would remain static thus fuel demand would drop, the opposit would happen. That is as efficiency increased the cost would drop and thus demand would increase. But further the economy would grow because of that increased use thus increasing further demand and consequent fuel use. This became known as Jevon’s Paradox and it has a nasty sting in it’s tail, in that if the economy slows the cost of fuel will increase disproportionately, which makes it harder to get the economy going again.

This outward looking view is infact what drives the Personal computer industry. You can see the sting in the tail with the cost of business desktop machines, as consumption moved over to laptops, and likewise for consumer use with the move from mini-towers running windows to pads and tablets running Android. Thus the hardware becomes considerably more complex and manufactured at a faster rate. This intern adds significantly to the requirements for not just the OS, but the Drivers as well. Which as we know has a considerable negative impact on security.

Further when Amdahls law “came of age” a paper was published in 1988 by John Gustafson and his colleague Edwin Barsis that made another point which we all have seen, but most of us call it “software bloat” not Gustafson’s Law.

Basically they argued much as Einstein had that it was time that should be the fundemental way of looking at things. That is computer users quickly get used to a certain time delay, and actually do not want a to rapid response as at a user level this can make them feel preasured. Thus any increase in effiency in turn increasing system performance and thus reducing cost encorages programers to use it to do more with it. Thus you get better graphics, sound etc but things still take about the same time. Which means not just a vastly increased code surface but also much greater complexity thus a double hit on security.

Worse though is the fact that the Computer industry has got it’s self into a tail spin. In order to survive and keep “retail price points” the same –even though they devalue due to inflation– they need to increase not just, “exponentialy increasing computing power”, but also “exponential increasing code functionality”. The problem is the easy wins are long gone hardware is hitting the buffers and thus the drive for more code with not just bells and whistles but dancing badgers behined the row of dancing hamsters.

But it’s not just the hardware running out of steam as Gordon Moore’s law reaches the hard reality of the laws of physics even software is hitting the buffers.

Code is now made by cut-n-past from examples found on the Internet, squiged into code libraries, that have increasingly complex thus less understandable API’s thus encoraging further cut-n-paste. Unfortunatly for general security such examples are written to clearly demonstrate a single point and are not cluttered with the likes of handling return values or out of range inputs. Security is not even a consideration in such examples, thus the quality of code in applications is tanking as we see in IoT.

Worse code reviews etc take time and experienced personnel, so they have gone to at best administrative check boxes as the experienced personnel are required to churn out more code. Likewise testing takes time so the tests get less in depth and often drop back to just checking that previous bugs are still fixed.

We used to get code patches, but Mobile Phones show us the reality if it happens it’s only whilst the product is for sale which is about a year. So landfill is the destination of a smart phone within a couple of years. Likewise pads, where they appear to have replaced socks on the Xmas prezzi list…

But there is yet another hidden sting in the tail, manufacturers have realised they are about to hit the buffers on not just hardware but software as well. So they have resourted to the old “tie them in” trick of a “Walled Garden” but more recently turning customers into product by what is politly called “Instrumentation”.

The problem with a walled garden is you need product and a lot of it. But some of the lucrative nature of “tied in” has gone, thus there is competition on price. Which means the owner of the walled garden is not the one making the goods in “the company store”. Which in turn makes a lie of the “increased security” FUD walled garden marketing droids spout. The simple fact is the owner of the walled garden does not have the resources to test each application package for security, even by functional testing. Which is why we have seen malware get into the walled gardens by the bucket full.

The reason the users don’t see the malware is that it’s nolonger “ego driven” like graffiti, it’s all about stealing user data to make money.

There is a false assumption that every company can live on the internet by stealing data and repackaging it and selling it. It’s not true, the market for such data is finite, thus subject to the notion of supply and demand. Which means that the price will drop at any given level of data as more entrants enter the market. So there are two solutions, firstly get out of the market ahead of the game, the second is to add value to the data. The likes of Google have been doing both for quite some time.

However new market entrants are just trying for more invasive data theft. To do this they have to change the market some how. Cloud storage is a good way to get peoples data, and although it was not originally intended for that in effect that is what it has become. This became possible because of Jevons Paradox applying to communications, there is in effect no profit on carrying data –though mobile phone companies are still trying–, thus the subscription or one time cost model applies[1] much like it does with an “all you can eat” buffet.

The result of this has been the return of the Thin Client Notion. You design a product to be a “head end” device like an old style terminal with all the data processing and storage being done somewhere else. It has advantages in that the head end is cheaper to manufacture, and maintainence advantages in that the software the user is interested in runs on a machine at the company that makes it so patching etc is done silently. But the downside is your data is beyond your control for ever. A point Google found out the hard way when the NSA tapped their inter data center communications.

Thus those who want to profit off of people as product are embracing the “thin client model” or the “colabarative model” that puts the desired data on their servers. Which has a downside as we have seen. It’s not just Google there was CarrierIQ before them that the NSA profited by, but more recently we have seen Microsoft force as hard as it can users into a locked in cycle with increasing spying and forced cloud usage. But we have also seen IoT spying with IP video cameras, with microphones built in continuously gathering data also Orwellian Televisions that watch and listen to you, toys that do the same to your children and now your luxury high end semi-autonomous vacuum cleaner.

The problem is it’s not just low level electronics and software security that john and jane have to worry about, literally every new product is now turning into a spy. To force this product designers are turning products into “thin clients” that only do what you want if they are connected to the internet. Because they have realised there is no profit in manufacturing any longer, it’s all in “Rent Seeking” subscription models. You used to get your land and be left alone to build a home etc. Then various rent seekers came along with “protection rackets” and we ended up with them as our kings, barrons and lords of the manner. Meer vassals that were then told that they were the lords vassals or surfs. Worse than being a slave you just had to be taxed how you lived and died was not a cost for the lord which a slave owner had to bear. Likewise a slave owner had to confine their slaves, not so with surfs society was their containment. It is this state of affairs we are regressing into via the electronics we buy but only get to use buy somebody elses whim…

Thus whilst I take an interest in security and the bottom end of the computing stack with the electronics and software, it is not down here that john and jane are having their real problems with security. That lies above the eighth layer with managment through legislation, the politicians that make the legislation and the 1% of the 1% who pay the politicians one way or another to do their bidding.
Which is to turn society backwards five hundred years where individuals own nothing, are not alowed to own anything and must pay relentlessly untill death the very few. That much vanted “trickle down” effect will be there but through the guard labour who’s sole purpose is to weed out those who do not willingly don the invisable chains of the Emperor to furnish him with fine cloths, so fine meer surfs may not be alowed to look upon them.

So my viewpoint has changed over time, we need sociological security more urgently than we need technical security. People are slow to adopt new ways of thinking and need to understand that they need to adopt secure behaviours and maintain them much as most now acknowledge they should look after their health. People have to learn security is a personal responsability something they have to work at to build up strength.

Don’t get me wrong I’m not turning my back on technical security measures they are the foundations we have to have that can not be undermined but they are but the building bricks. People in general do not see or even want to see bricks, they want to see buildings in which they can live and work safely and securely. They don’t want to learn to be builders, nor do they want to be without buildings living what they see as a more primative existance. That is they have a comfort zone and for the majority that is where we need them to apply security to their lives. From there as they gain security strength they can expand outwards and widen their comfort zone. Some will take an intetest in technical security, most however will in one way or another take interest in social security ensuring that politicians work for who vote for them, not the fractional few who buy the politicos in one way or another.

Whilst this blog did start as a very technical blog and still covers it, our host has moved onwards to the social and economic side of security, thus the subjects covered has broadened out.

But whilt the social side is important we must realise that it is the economics of production that makes it possible.

Which brings us around to the question of the production of software and hardware. I’ve long argued that whilst hardware is engineered, software is at best crafted. History shows us that infact all things man maked are first created in the mind, then crafted into a tangible form which is then tested to the point where they need to be engineered via the principles of science. We test via tools, which are also made by tools, which at a fundemental level are designed from the bedrock of intangible logic up through mathmatics and meet the tangible world at measurands which get derived from fundemental physical properties.

The purpose of economics is actually efficiency, and to build the mathmatical models to be able to get there. In the process it does not address much that makes society society and does not cover much that is social and thus important to society.

The art of software is in many respects a social process, one aspect of which is how to do things not just effectively but efficiently. Thus it is subject to economic processes.

You and I broadly agree on “the C question” I put it as stradling the gap between assembler and high level languages, you see it as a meta-assembler. In essence the difference is where we see the low water mark for high level languages. I see it at partial almost minimal abstraction, you see it with a greater level of abstraction but importantly you see safety as being essential to the required level of abstraction whilst I do not to the same extent. You could say I regard the tool by what it does, not how it does it outside of that function. Thus I do not consider at that level the aditional functionality that protects the operator from the tool or how the tool protects the workpiece from the operator. Thus I regard guards and stops as being something added to a table saw functionality whilst you see them as integeral to the table saw operation. It is actually a difference in view point in the economics of production.

That’s not to say I do not consider it important it’s just where I draw a functional line. The reason for this is the direction I am coming from which is bottom up not top down. I see the function of the tool as a specific design, likewise I see the guard as a specific but seperate design likewise the limits etc. That is I take a tool makers view not an operator view. However the economic view although present in the tool design is also above the operator level at the process and managment levels.

The aim of a process is to take raw materials and add value to them to increase their utilitarian value. Implicit in that is that the proces cost be minimised to ensure that it remains viable at some level. This means making the process efficient which is where the aims of economics impinge.

A table saw that has no guards or stops used by a skilled operator will do the entire range of things possible. But the reality is it is rarely used out of a small subset. So whilst the cost of the tool is a lot less the cost of a skilled operator is much more than a semiskilled operator. However a semiskilled operator has a higher probability of getting injured. So ecanomicaly the managment choice is to buy a more expensive table saw and gain that back by using lower paid less skilled labour.

In essence your argument for type safety etc whilst totaly valid and sustainable from a security aspect, also has a valid economic argument, in that enables the use of less skilled workers to produce the same level of “piece work”. It also has other arguments as well in that it lightens both the cognative and progrming load on the programmer. That is they do not need to think about or write program logic to check for range conditions etc. As long as they do so for return values caused by exceptions.

Where it goes wrong is two fold, firstly way to many programers do not adiquatly deal with return values and the prefered way of dealing with exceptions is to just abort, which is actually the worst thing to do in a system view. Secondly because of the “hand holding” they are not used to dealing with errors and their diagnosis, thus they only reach a certain skill level above which their limitations and failings return. The latter issue becomes a major issue in that what might be a minor issue for a skilled programmer becomes a major if not insurmountable problem to the lower skilled programer. As these problems can be viewed as either edge or corner cases thay will often not get resolved and simply become known faults in the code that gets pushed out to the public and await a maintenance relese. It is these faults that become the prime vulnerabilities for skilled attackers.

It then becomes a probability question as to if a maintenance release fixes the vulnerability before it is found and exploited. The view used to be that even if a vulnerability was found it would quickly become public thus fixed. We are now finding out that this is far from true. Vulnerabilities are found and it depends on the mentality of the finder or their employer if it becomes public or not. In essence vulnerabilities are either outed for personal reasons or they remain hidden and exploited covertly often for long after the product they are for is nolonger supported.

Thus we have a “growing pains” problem. Increasingly high level languages will alow most programmers to be much more productive. But such languages are known to be insufficient, thus further more formal methods are needed and this means that much more resources are used in production which is not desirable in a competitive environment. Which is what happened with Victorian boiler makers. The result is the need for more powerfull more efficient boilers led to an increase in failures that could not be hidden or ignored. Thus Parliament passed safety legislation that caused science to become a proffession and artisans and craftsmen to become scientifically literate and thus become engineers.

Currently most people who write software are at best artisans, many due to the drudgery of commercial work find an outlet for their creative side in Open Source Software. Few use formal methods and many have no notion as to what they are. Software houses by and large have little or no interest in correct functionality let alone security. That is they care little about reliability or safety just getting bells and whistles to market. Interestingly untill very recently few commercial application software houses cared about a reputation for correct functionality, reliability, safety or security in their product releases. The exceptions were those who were making ICS and mission critical software. As the likes of NASA and others have shown correctly functioning software that is reliable and safe for use, needs to be engineered and this is an exacting and resource intensive process. One that the current application software market will not on any way support as they would be out of business before they got their next release out of the door.

A lookback at history shows that yes boilermakers took a hit when legislation came in but as they all took it at the same time they survived though it did effect the economy somewhat.

But one important thing came out of the process and that was fully tested fully specified and standardised parts. Because they were standard you had multiple suppliers and their properties were well known. This started the standardisation of parts which alowed greater efficiency with the advent of two world wars it became not just parts but whole sub assemblies that became standard. This enabled buildings to be produced way more efficiently and quickly than older methods.

And that is the point, the software industry needs to move from being artisanal to enginering.

Further programing of applications needs to become more like shell scripting that kicked off the idea of rapid prototyping. The majority of programers should not even be using what we call high level languaged, they should be taking standardised tasklets and scripting them together. That way productivity levels can be maintained but quality and security levels raised significantly, whilst also making maintenance and upgradability more efficient and sustainable.

[1] The earliest form of this was with the Uniform Postal Rate from Victorian England with the Penney Black stamp. It cost you a penney irregardless of if your letter was going one street, one town or the length or bredth of the country away. Likewise it did not matter if your letter contained one or one hundred words, it just had to be below a certain size.

Clive Robinson • August 3, 2017 9:22 AM

@ JG4,

Using Tech Tools to Do Data Reporting NYT. I guess that’s why the Times could axe 27 reporters and gut the copy desk; they’re going to do everything with data! Oh, and video.

The idiot behind the idea is the NYT CEO who previoulsy was the Director General of the UK’s BBC, where he decimated news and journalism to the point it was easy for the Rupert Murdoch runts to use it as a significant advantage in their desire to destroy the BBC and other UK broadcasters.

I would be unsuprised to find he was on the take from News International / Fox etc in some way either directly now or “on a promise” for future lucrative benifit.

But as you might know I’ve been warning about his behaviour for some time now. Let’s just say his stupidity / perfidy is less becoming less covert these days…

Clive Robinson • August 4, 2017 4:54 AM

@ SlimeMould…, furloin, Thoth,

The UK Guardian Newspaper that @Bruce used to wrote opinion pieces for, has a piece about Markus Huttchins, who was arrested by the FBI at the airport,

https://www.theguardian.com/technology/2017/aug/03/researcher-who-stopped-wannacry-ransomware-detained-in-us

Marcus is not saying anything and has claimed 5th amendment rights, (let us hope he did it correctly) because he had no representation according to the article and is due back in court today.

The FBI he wrote or is involved with the Kronos malware. However the FBI are known to go overboard with foreigners who are briefly in the country (remember the Russian researcher who revealed that Adobe app encryption was compleate crap).

In essence the FBI MO is “grab, scream, deny, blackmail and export” the latter two to prevent the person from suing the FBI for damages etc.

A point that non US citizens should note, is that as far as we know the researcher Marcus Huttchins has not committed any crime, anywhere, let alone in the US.

On the assumption he did write some code that did get incorporated into Kronos. Firstly the code may not be exploit code (ie attack vector or payload). Secondly malware writters are not exactly unknown for stealing every bit of code they can from other places. Even the US & Israeli IC’s do this, as have corporations like Sony and many many more.

Likewise a very large number of everyday “code cutters” cut-n-pastes from any place they can find on the Internet. Put simply if you put any example or other source code up on the internet some one is going to “borrow” it usually without credit or payment etc etc.

It’s also quite common for malware research example –like Proof of Concept (POC)– code to get circulated and copied.

And let’s be honest the FBI have a bad reputation of trying to prosecute foreigners to points way way beyond that they would do to US citizens because as far as they are concerned there are no downsides to doing so. Because few US citizens will care about foreigners in trouble so no newsworthy protests, and if they can not find anything that will work in a court they keep threatening “you will die in prison” then do a deal to get the person out of the country never to be alowed back to fight for their rights etc. It’s an age old process that any criminal defence lawyer will tell you about, it’s called “Rights Stripping”. We’ve seen it with the witholding of evidence such thst the DoJ can claim that a person “Has no standing” and the court kicks the case out. Oh and as has been shown the FBI are not above a little manufacturing of crime, which most would call “Deliberate Entrapment” or worse. Likewise as has been discussed here often the cyber legislation is realy realy badly written and of such wide scope to the point you could be convicted reading the screen of an unattended computer like an ATM or advertising hording facing onto a public walkway…

So we will have to see how this plays out.

But as I’ve said befor my name has been associated with a DMCA takedown, thus as far as I’m now concerned the US is off of my travel itinerary even for flight changes.

Clive Robinson • August 4, 2017 6:47 AM

Auz claims major terrorist plot foiled

In todays news is that Australia has foiled a sophisticated aircraft bombing attack by a Islamic State linked terrorist using parts imported from Turkey…

https://www.theguardian.com/australia-news/2017/aug/04/australians-terrorism-charges-accused-building-bomb-isis

Apparently the suspects having received the parts did not procead with the plan. Which appears lucky because “inteligence” and raids did not happen till after the original planed dates. There are a bunch of other odd statments as well.

Is it just me or have other peopke noticed that many of these supposedly “foiled plots” occur in the 5eyes nations implementing the most draconian privacy invasion yet seen. Coincidence? Cause and effect? FBI style create a terrorist entrapment?

It’s interesting to see Turkey being fingered, they would have been on the US “5h1t list for MSM sound bites” like North Korea, Iran, China and currently Russia if they had not scored bonus pixie points by shooting down a Russian aircraft involved with supporting the Syrian Regime (case of my enemies enemy).

Oh international politics is a fun game…

Clive Robinson • August 4, 2017 12:29 PM

@ Wael,

Have an open mind!

You should remember Terry Pratchett’s observation on that,

The problem with having an open mind is, people will insist on coming along and filling it with all sorts of rubbish.

Clive Robinson • August 5, 2017 2:31 AM

@ Bong Smoking…

Problem is it’s full of all sorts of rubbish 🙁

So the Bong is not realy a bong but an industrial grade incinerator…

Which means we woukd have to call you,

Mind Incinerating primate savant (MIPS)

In future 😉

Clive Robinson • August 5, 2017 5:23 AM

@ Thoth,

Turkey has indirectly allied it’s self with China by alowing ISIS oil to be shipped through Turkey. As China and Russia have much warmer relations these days than they have done in the past, it may be a case of “My friends friend”. However they did as far as we know shoot down a Russian military aircraft that was engaged in actions in Syria possibly against the Kurds, which the current Turkish leadership hates, so there is a puzzel to contemplate.

With regards,

Will steganography go the same way as encryption and be unlawfully outlawed by war mongering greedy politicos who have no care about mathematics ?

Yes but for less obvious reasons.

You have to start by differentiating codes and ciphers. It’s the latter that tend to use mathmatics in their use not the former. Further codes are not one to one in their mapping or sizes which is why they are much more broadly usefull and are found in both compression, and error correction.

One use of codes is in One Time Phrases. These saw use during WWII with the BBC transmitting “Now for some messages for our friends…”. You pick a harmless set of phrases more or less at random such as “The cat sat on the mat”, “The dog chased it’s tail, “The frog hopped”, “The bird sang” etc to these you give one off meanings such as “Attack target A”, “meet at point x” etc. The enemy hears the messages but can not ascribe meaning to them. Further to reduce the chance of analysis you always send the same number of messages each time thus there are meaningless phrases transmitted as well.

You can do similar with personal communications on the phone or by letter. The difference is that the phrases have to sound natural within the rest of the letter or phone call.

The advantage as far as the authorities are concerned is that they can use such a banning law to imprisson people they do not like. Because of the duality of logic, if they can not prove a message is hidden in a text, you can not prove there is not a message hidden in the text. All they have to do is show spurious correlation sufficient to a bunch of rubes selected for jury service. In some jurisdictions they do not even have to win just bringing the case means you are imprisoned or impoverished then subject to funneling nearly all your resources into defending yourself. Even if you win they will ensure that there is noway you can get restitution. So they effectivly fine you into non existance.